One of the challenges faced
by clinicians and investigations in accumulating data that might be used for
research, is to determine the rules that apply to ensure its availability if
and when the research moves forward. The challenge that arises stems from the
need to protect patients’ privacy, as well as meeting other requirements of
HIPAA and the IRB process. Meeting this challenge requires an understanding
of a series of issues:

What is research?

What is human subjects
research?

Under what circumstances
can the accumulation of data be considered the creation of a data repository?

What rules apply to research
involving coded private information?

OHRP has addressed these
issues on several occasions in the past, most notably though its guidelines
published in November 1997, and the HHS guidance on research repository databases
published in January 2004. Notwithstanding these publications, many questions
remained. The publication in August of its Guidance on Research Involving
Coded Private Information or Biological Specimens helps to clarify OHRP’s
views on a number of the key issues.

The definitions

What Is Human Subjects
Research?Research is defined by regulation [45 CFR § 46.102(d)]
to be "a systematic investigation, including research development, testing,
and evaluation designed to develop or contribute to generalizable knowledge."
The definition is flexible and, at the same time, leaves a number of open questions.
For example:

Are all quality reviews
designed to develop best practices research?

If risk management activities
are reported to carriers, are they research?

Is simply collecting
data in the hopes that it could be used at some point in the future for an
as yet undefined research activity, classified as research?

The regulations also defines
"human subject" [45 CFR § 46.102(f)] and delineates parameters of human subjects
research which would be subject to IRB oversight:

Human subject means a living
individual about whom an investigator (whether professional or student) conducting
research obtains:

1. data through intervention
or interaction with the individual;
2. identifiable private information.

Intervention would include
direct physical activity — gathering blood — or environmental changes for research
purposes. Interactions would expand the reach to the communication process,
such as when an investigator takes a history.

Information, which for
these purposes, is private, is the product of the reasonable expectations of
the subject. If information is gathered in a setting or from a record in which
the subject would not expect an observation to occur or to be made public (e.g.,
the patient’s chart), then, under the regulations, it is private. The definition
is designed to be flexible and protect the privacy expectations of the patient/subject.
It is not, however, a black-and-white test. (Are photographs of people sunbathing
in a private club private information? At the beach?)

To actually constitute
human subjects research, the private information must be individually identifiable.
This means that the subject’s identity is or can be readily ascertained by the
investigator or associated with the information.

For purposes of this guidance,
coded also is defined as: identifying information (such as name or Social
Security number) that would enable the investigator to readily ascertain the
identity of the individual to whom the private information or specimens pertain
has been replaced with a number, letter, symbol, or combination thereof (i.e.,
the code); and a key to decipher the code exists, enabling linkage of the identifying
information to the private information or specimens.

Finally, the scope of coverage
of the guidance, and, in turn, the rules, is important. Those covered by the
applicable research structures would include not just the principal investigator
or those investigators specifically responsible for the conduct of the study,
but anyone actually involved in conducting the research. Hence, those who study,
interpret, or analyze data; author research reports; or participate in presentations
related to the research would also be bound to adhere to the rules governing
human subjects research.

OHRP notes, however, that
the conduct of research does not occur solely by providing coded private information
or specimens. This may mean that simply gathering data for some unspecified
future use is neither research nor is the individual performing such a function
engaging in research. On the other hand, if the same person who provided coded
information collaborates on other activities, they would, of course, be a part
of the research team.

OHRP’s guidance presents
a concerted effort to let the research community know where the boundaries will
be. From OHRP’s perspective, in interpreting the regulatory requirements [45
CFR § 46.102(f)], the key is to understand what it means to "obtain" the information
or specimens in question. For OHRP, obtaining means:

receiving or assessing
them for research purposes;

an investigator’s use,
study, or analysis for research purposes.

Private for these
purposes means that the information or specimens can be linked to specific individuals
— directly or indirectly (such as through coding system). Where that linkage
does not exist, or cannot be made, human subjects research subject to the applicable
rules is not occurring.

Importantly, this means
that if the information (or specimens) is not collected specifically
for a currently proposed research project through an interaction with
living individuals, and the identities of those providing the information
or specimens is not readily ascertained by the research team, human research
is not involved. This formulation is at the core of any analysis.

OHRP points out, it means
that human subjects research is not occurring if:

the ability to decipher
the code is destroyed before the initiation of research;

the investigators and
those creating or holding the keys to deciphering the code enter into an agreement
prohibiting their release under any circumstances, provided any of the individuals
involved remain alive (an agreement that OHRP says need not receive IRB approval);

the IRB itself adopts
formal policies and procedures for a repository or data management that prevent
release of the code key while patients remain alive;

there are some other
legal requirements which accomplish the same goals.

Applying these parameters
to daily experiences mean that, at least, routine hospital or physician information
or specimen gathering, observations and analysis would not be human subjects
research — absent a specific gathering of such for currently proposed research.
In this group of activities, there would be ordinary creation and maintenance
of medical records or the ongoing collection of a tissue repository.

To implement the guidance
requires education of those who will be affected. The approval that may be useful
is through a Q&A type of communication to the academic and research community
within the institution. That communication could also provide examples of the
application of the underlying principles. For example: What happens if an appropriate
agreement exists not to release or share the material necessary to decipher
coded information, but the identity of one of the individuals is unexpectedly
or accidentally disclosed?

In other words, the investigator
now knows, or could readily discern, the identity of a participating patient,
and the information related to that subject no longer meets the definition of
private. The guidance tells us that human subjects research now is being conducted,
and absent the application of some exemption [see 42 CFR § 101(b)], the IRB
processes must be involved including, where appropriate, informal consent.

Or what happens if information
unexpectedly comes to light where it is necessary to identify one of the participants,
and it is possible to do so? Again, to proceed, the information would no longer
be private, and human subjects research processes would be required.

To address the myriad situations
that may arise, the OHRP also recommends that there be an individual nested
with decision-making authority. That individual should be someone other than
an investigator to ensure an independent determination.

To apply the outlined process,
the focus must be on what actually is being obtained by the investigators. If
it is limited to information or specimens where the investigator — as opposed
to the patient’s own physician — is not able to readily ascertain the patient’s
identity, then the investigation is not engaged in human subjects research.
Neither, of course, is the physician.

Where the patient’s physician
also is the investigator, the opposite conclusion is the case.

A closer question exists
when, for example, a physician begins collecting data without a current research
project in mind. Later, the physician decides that the data bear investigation
for research purposes and asks a third party to mask the data to prevent identity
discovery. To be safe, this should be considered human subjects research, even
though technically arrangements could be made to ensure privacy requirements
were met.

If the information was
coded from the inception, however, although human subjects research was being
conducted, the research study could potentially still qualify for an exemption
under 45 CFR 46.101(b)(4) as that data could be adequately masked.

Finally, OHRP cautions
that the Privacy Rule, which is the product of HIPAA legislation, has its own
rules and requirements. Thus, in contrast to the HIPAA privacy requirements,
information that is linked with a code derived from identifying information
is not considered to be individually identifiable under the research rules [45
CFR § 46.102(f)] provided the investigations cannot readily ascertain subject
identities.